Vulnerability Management

Owner: Security
Reviewers: Engineering, DevOps
Status: Draft
Version: 0.1
Last Updated: 2026-09-16
Review Cycle: Monthly or per release

Current Controls

• CI runs lint/build/test for backend and web.
• Dependency manifests exist for backend, web, mobile, root and IoT worker.

Required Process

• Review dependency updates regularly.
• Track critical/high vulnerabilities to closure.
• Validate Docker image base updates.
• Add scanning provider and reporting workflow.

Open Items

• Dependency scanning tool.
• Container image scanning tool.
• Severity SLA.
• Exception/waiver process.